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MUSCULAR 

• Minor circuit move, not collection suite move 

(so-201 3-00762) 

• XKS FP updates across TU systems / 

N Archive throttle update 

INCENSER 

• INCS4 config issue (uo-2013-00471) 
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Speaker's Notes 



From Feb 28 2013: Proposed/imminent latest DO/Volume reduction: Narchive 

BLUF: Requested S2 concurrence at S2 TLC on 25 Feb with partial throttling of content from Yahoo, Narchive email traffic which 
contains data older than 6 months from MUSCULAR. Numerous S2 analysts have complained of its existence, and the relatively 
small intelligence value it contains does not justify the sheer volume of collection at MUSCULAR (l/4th of the total daily collect). 

Background: Since July of 2012, Yahoo has been transferring entire email accounts using the Narchive data format (a proprietary 
format for which NSA had to develop custom demultiplexers). To date, we are unsure why these accounts are being transferred - 
movement of individuals, backup of data from overseas servers to US servers, or some other reason. There is no way currently to 
predict if an account will be transferred via Yahoo Narchive. 

Currently, Narchive traffic is collected and forwarded to NSA for memorialization in any quantity only from DS-200B. On any given 
day, Narchive traffic represents 25% (15GB) of DS-200B's daily PINWALE content allocation (60GB currently). DS-200B is scheduled 
to be upgraded in the summer of 2013; it is likely that memorialized Narchive traffic, if still present in the environment, will grow 
proportionally (i.e. double now, to 30 GB/day). 

Narchive traffic is mailbox formatted email, meaning unlike Yahoo webmail, any attachments present would be collected as part of 
the message. This is a distinct advantage. However, it has not been determined what causes an Narchive transfer of an account, so 
these messages are rarely collected "live". 




Based on analysis of Narchive email data anclj 

communications date for Narchive email messages collected: 



, we were able to indentify statistics for the original 
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Numerous target offices have complained about this collection "diluting" their workflow. One argument for keeping it is that it 
provides a retrospective look at target activity - this argument is hampered by a) the unreliable and non-understood nature of when 
the transfer occurs for an account, and b) that FISA restrospective collection would retrieve the exact same data "on demand". 

SSO Optimization believes that while this is "valid" collection of content, the sheer volume and the age - coupled with the 
unpredictable nature of Narchive activity - makes collecting older data a less desirable use of valuable resources. 59% of Narchive 
email collected was originally sent and received more than 180 days after collection. This represents about 8.9 GB a day of "less 
desirable" collection - long term allocation that could be easily filled with more timely, useful FI from this lucrative SSO site. As 
always with our optimization, the data would still be available at the site store for SIGDEV. This would not impact metadata 
extraction. 

Past DO volume reduction efforts: 

Webmail OAB- Leap day 2012: the original defeat only targeted gmail, yahoo, and hotmail webmail protocol 
FB buddylist sampling since last year 

Today: FB OAB defeat/atxks/facebook/ownerless_addressbook : this is a JSON addressbook 




http://www.documentcloud.org/notes/print?docs[]=813020 



Excerpt from SSO Weekly 

3 Pages - Contributed by Matt DeLong, Washington Post - Oct 30, 2013 

This document is an excerpt from Special Source Operations Weekly, an internal National Security Agency publication dated 14 
March 2013. It describes a common NSA problem of collecting too much information - and how the agency is attempting to control 
it. 
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Speaker's Notes 



from Feb 28 2013: Proposed/imminent latest OO/Volume reduction: Narchive 

BLUF: Requested 52 concurrence at S3 TIC on 25 Feb with partial throttling of content from Yahoo, Nar chive email traffic which 
contains data older than 6 months from MUSCULAR. Numerous 52 analysts have complained of its existence, and the relatively 
smalt intelligence value it contains does not justify the sheer volume of collection at MUSCULAR (l/4th of the total dally collect). 

Background: Since July of 2012, Yahoo has been transferring entire email accounts using the March ive data format fa proprietary 
format for which NSA had to develop custom demultiplexers). To date, we are unsure why these accounts are being transferred - 
movement of individuate, backup of data from overseas servers to US servers, or some other reason. There is no way currently to 
predict if an account will be transferred via Yahoo Narchtve. 

Currently, Narchive traffic is collected and forwarded to NSA for memorial i/at ton in any quantity only from DS 2D0B. On any given 
day, Narchive traffic represents 25% (15GB) of D5~200B's daily PIN WALE content allocation (GOGB currently). OS 200B is scheduled 
to be upgraded m the summer of 2013; it Is likely that memorialised Narchive traffic, if still present in the environment, will grow 
proportionally (Le, double now, to 30 GB/day). 

Narchive traffic is mailbox formatted email, meaning unlike Yahoo webmail, any attachments present would be collected as part of 
the message. This is a distinct advantage. However, it has not been determined what causes an Narchive transfer of an account, so 
these messages are rarely collected “live*. 
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From Feb 28 2013: Proposed/imminent latest PO/Volume reduction: Narchive 

BLUF: Requested $2 concurrence at $2 TIC on 25 Feb with partial throttling of content from Yahoo, Narchive email traffic which 
contains data older than 6 months from MUSCULAR. Numerous 52 analysts have complained of Its existence, and the relatively 
small intelligence value it contains does not justify the sheer volume of collection at MUSCULAR (l/4th of the total daily collect). 
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Background: Since July of 2012, Yahoo has been transferring entire email accounts using the Narchive data format (a proprietary 
format for which NSA had to d eve bp custom demultiplexers). To date, we are unsure why these accounts are being transferred - 
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predict it an account will be transferred via Yahoo Narchive, 



PIMWALE (p. 2) 



Currently, Narthive traffic H collected and forwarded to NSA for memorialuation in any quantity only from QS-20QB. On any given 
day, Narchive traffic represents 25% (15GB) of D5-20QB's daily PIN WALE content allocation (60GB currently), DS-200B is scheduled 
to be upgraded in the summer of 2013; it is ikely that memorialed Narchive traffic, if still present in the environment, will grow 
proportionally (Le. double now, to 30 GB/day). 



SSO (p. 3) 



SSO Optimization believes that while this is "valid* collection of content, the sheer volume and the age - coupled with the 
unpredictable nature of Narchive activity - makes collecting older data a less desirable use of valuable resources. 50% of Narchive 
email collected was originally sent and received more than 180 days after collection. This represents about 8.9 GB a day of "less 
desirable" collection - long term allocation that could be easily filled with more timely, useful FI from this lucrative SSO site. As 
always with our optimisation, the data would still be available at the site store for SIGDEV. This would not impact metadata 
extraction. 
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